7

We got a hacked Magento website that is on update 1.9.2.4.

The files that are hacked are:

  • api.php
  • indexs.php: hackscript
  • postfix.php: hackscript
  • skin/adminhtml/default/default/filesystem/css/loader.php
  • js/editarea/plugins/charmap/jscripts/ajax.php

The hacker used our server to bounce mail Gmail sites to find existing mail addresses. In the mail attachment, he used another hacked Magento site to host other files.

mailbody

How can an updated Magento site get hacked? What can we do about it?

  • i have faced this type of issue to one of my project.Where hacker got server root access and change all code... So my suggestion to change reinstalls your install Magento system at new server. Before doing this, do magento full instance virus screen. Fix the coding issue – Amit Bera Jun 28 '16 at 10:52
  • 1
    do a diff of the core files from a clean magento instance and your website and remove what should not be there – Marius Jun 28 '16 at 11:07
  • 1
    make sure you install all security patches. – Baby in Magento Jun 28 '16 at 11:13
  • 1
    Keep in mind that security is more than secure code. How your server and network is set up is just as important. Also, any module you installed is not guaranteed to be secure, even if it's popular and highly reviewed. – Goose Jun 28 '16 at 15:13
  • 5
    Possible duplicate of Magento hacked even after applied patch – MagenX Jun 28 '16 at 15:14
7

Unfortunately without knowing the initial point of entry it's impossible to say. It could be any of the following, which I've listed in order of my own opinion of likeliness.

  1. You were hacked via a 3rd party extension.
  2. You were hacked via other software on the server, such as wordpress.
  3. You were hacked before you upgraded to 1.9.2.4 and they used access that they gained prior to the update (new admin user, ssh/ftp, reverse shell) to re-hack the site.
  4. Somebody brute forced a user account for ftp / ssh.
  5. Your own password credentials were hijacked via a virus / malware on your own machine.
  6. There's a new attack vector in the wild that hasn't been patched yet.

Without an in-depth analysis of all server logs and the source code, it's difficult to say.

  • This is a better answer of what could have caused the issue, but not enough on what he can do now. – Goose Jun 28 '16 at 15:13
3

How can an update Magento site get hacked?

A Magento site like any site is vulnerable because it is connected to the internet. The more popular, the higher chance that someone or something (bot) will try and gain access to your website.

How can it get hacked is a loaded question, but typically leaving security vulnerabilities open for convenience SSH / FTP and not taking the proper precautions will invite trouble. Most of the time these services are left with default ports which are easily scanned for by bots and in turn are distributed to others for attempted access. Not properly applying security patches to the system (magento and operating system) can also leave the door open to a possible breach;

Failing to detect hacking attempts are generally because there is no mechanism in place to notify the system owner of the attempts. You also need to check you security logs regularly for suspicious activity.

Giving access to unknown developers could also open a possibility of them leaving a way to gain access in the future. I never give direct access to anyone I hire, if they need access they walk me through it but typically I only allow access to my dev server.

what can we do about it.

There isn't enough information but:

  • Restore your files from a backup
  • If no backup is available, take a note of all changed files (date/time stamp) and replace with known good ones

Passwords

Magento:

  • Check all system users, remove any new ones that do no belong
  • Change all passwords for valid users
  • Change admin panel link

System

  • Change all system passwords
  • Disable any unused and/or unnecessary accounts
  • Disable all non essential access points (ie: SSH, FTP)
  • If you need SSH or FTP, change the default ports

Continue to monitor and block any suspicious IP blocks that are trying to access restricted areas.

If you believe any of your users data and information have been compromised, it would be ethical to inform them of the breach.

1

Interesting! My site is a rock. Anybody can crack my site. Please try it on my site.

Some credential information is as follow.

www.biblesatcost.com
www.biblesatcost.com/administrator 
ssh user: biblesat
pass: CelestialSeasonings

 <host><![CDATA[localhost]]></host>
 <username><![CDATA[biblesat_bacmain]]></username>
 <password><![CDATA[Maximum3]]></password>
 <dbname><![CDATA[biblesat_bacmage]]></dbname>

We are looking forward to hearing from you.

Regards.

  • I does not give a solution to the problem. Please use the comment section for comments. – brentwpeterson Apr 20 '17 at 20:23
1

The thread is too old, but I would like to mention few tips which can help you to recover your hacked Magento site and also secure it from future vulnerabilities. These points are:

  • Identify and determine the hack

  • Scan Your Magento Store with MageReport

  • Check Google Transparency Report

  • Compare and Clean Modifications in Files and Folders

  • Clean Magento Hacked DB Tables

  • Secure the Magento Admin Panel

  • Apply Security Patches and Upgrade Magento Version

  • Use Secure Connections

  • Create Backups once your Magento store is recovered

  • Last but not the least, Use Secure Magento Hosting

The best practices include keeping your Magento and its extension versions up to date, using smart and unique usernames and passwords, custom admin login path, and SSL certificate, etc. To know further more about it, read the entire blog post I've written. Please have a look at Recover Your Hacked Magento Store.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.